Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Jan 2017 07:27:13 +0100
From: Salvatore Bonaccorso <>
Cc:, Colin Watson <>
Subject: Re: Re: CVE Request: icoutils: exploitable crash in
 wrestool programm


On Sun, Jan 08, 2017 at 02:47:40PM -0500, wrote:
> Hash: SHA256
> > an exploitable crash in wrestool from the icoutils
> >
> >
> >> wrestool/fileread.c
> >> On 64-bit systems, the result of subtracting two pointers exceeds the
> >> size of int
> Use CVE-2017-5208.

Thanks for the CVE assignment. Ftr, this was upstreamed as

It turns out that this is not enough, so upstream has issued

to make the checks more stringent. Quoting a reply from upstream to the Debian
maintainer "But as I see it there are still combinations of the arguments which
make the test succeed even though the the memory block identified by
offset&size is not fully inside memory&total_size ??? e.g. offset < memory, but
size is larger than the difference.  I have attached another patch (applies on
top of yours) that more stringently checks all the memory bounds. Hopefully
that will preempt shenanigans with specially crafted files containing weird
offsets and sizes."

Could you please assign a further CVE for this follow up fix?

Furthermore I would like to ask if the following two commits from upstream,
can have as well an identifier assigned:

They relate to the Red Hat bugzilla entry at

All the three followup commits are included in Debian with the recent
upload to Debian unstable, versioned as 0.31.1-1.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.